ISO 19011, Guidelines for auditing management systems, was revised in May 2026. The fourth edition, ISO 19011:2026, cancels and replaces the 2018 third edition. It remains guidance: no organization is certified or accredited against ISO 19011, and nothing in your accreditation standard changed with it. It is still worth your attention, because it is the agreed reference for what good management system auditing looks like, and the standard your certification body is accredited against draws on it. This page covers what the revision changes, what it does not, and what ASCB expects accredited certification bodies to do.
How a guideline reaches your accreditation
The route is worth setting out, because it is often misstated. ASCB operates to ISO/IEC 17011, the requirements standard for accreditation bodies, which does not reference ISO 19011 at all. Certification bodies performing management system certification are accredited against ISO/IEC 17021-1, which does: it draws on ISO 19011 for audit principles, the shape of the audit process, and auditor competence, and then adds the third-party requirements that ISO 19011 does not address, such as the certification decision, impartiality, and the certification cycle.
ISO 19011's own introduction draws the same line: the document concentrates on internal audits and audits of external providers, and for third-party management system certification it points to ISO/IEC 17021-1 as the requirements standard, with ISO 19011 offering useful additional guidance.
The practical consequence: when ISO 19011 is revised, the reference point for good audit practice moves, and the way a certification body plans, conducts and staffs its audits is expected to move with it, even though ISO/IEC 17021-1 itself is unchanged.
What the 2026 edition changes
The revision is focused, and narrower than some of the commentary suggests. ISO names two main changes in the foreword: the guidance on remote auditing methods now draws on ISO/IEC TS 17012, and Annex A is expanded to cover remote auditing methods and virtual locations. Around those sit a small number of substantive additions.
Remote auditing becomes a defined method
The 2026 edition defines remote auditing method as a term of its own, at Clause 3.4, drawn from ISO/IEC TS 17012:2024, with virtual locations addressed in the notes to the definition. The expanded Annex A carries the practical guidance. The substance will be familiar to bodies that audited remotely under the 2018 edition; what changes is that the method now has a name, a definition and developed guidance, which makes it easier to build into procedures and harder to treat as an improvisation.
Emerging technology, including AI, enters auditor competence
The generic knowledge and skills expected of management system auditors, at Clause 7.2.3.2 a), now include understanding when information and communications technology (ICT) tools, and emerging technology such as artificial-intelligence-based evaluation tools, are appropriate for conducting an audit, and with what consequences. This is the most substantive content addition in the revision: the judgment about when to use such tools, and when not to, now sits inside the auditor's competence requirement rather than outside it. Data protection and information security also appear in the auditor's statutory and regulatory knowledge area, at Clause 7.2.3.2 d).
The audit programme risk list grows
The risks to consider when managing an audit programme, at Clause 5.3, are expanded. New risk areas cover the selection of the audit method, sponsorship of the audit programme, and the security of ICT methods, with unsecured platform selection the named example, and the risk on selecting the audit team now names auditor independence and impartiality. Where remote methods are used, platform security is now explicitly a programme-level concern, not only an operational one for the audit team.
What stays the same
The architecture is untouched. The seven principles of auditing at Clause 4, integrity, fair presentation, due professional care, confidentiality, independence, the evidence-based approach and the risk-based approach, are retained materially unchanged from 2018, and so are the audit process model and the reporting and follow-up clauses. A body asking whether the basis of audit conduct has changed can be told it has not.
Audit reporting templates do not need material revision. What is worth confirming is that they can accurately record remote-audit and virtual-location information where that is part of the audit scope, since the revision gives those concepts standing that the 2018 edition did not.
What the revision does not say
Some commentary in circulation attributes content to the revision that is not in it; climate change provisions are the clearest example, and no such content appears in ISO 19011:2026. Work from the published text, available from ISO or your national standards body, rather than from summaries. The accuracy duty that applies to everything your body publishes applies to what you tell your clients about this revision too.
What ASCB expects
ASCB's formal expectations are set out in advisory note ASL(AN)37, issued to accredited certification bodies. ISO 19011:2026 is a guideline, so there is no transition period: it applies from publication. ASCB expects accredited bodies to be familiar with the 2026 edition, to make the updates below without delay, and to be able to demonstrate both at their next assessment.
The updates:
• Review and update the documents that reference ISO 19011, including internal audit procedures, the auditor competence framework, and continuing professional development programs, so references point to the current edition and reflect its content.
• Address the Clause 7.2.3.2 a) knowledge and skills on ICT tools and emerging technology, including artificial-intelligence-based evaluation tools, in your competence framework and CPD activity.
• Where you use remote auditing methods, address the security of ICT methods as a programme-level risk, consistent with Clause 5.3.
A sensible order of work
Four steps, in the order that pays best:
• Obtain the revised standard from ISO or your national standards body, and run a gap analysis of your auditor competence framework, audit procedures and internal audit program against it. Document the gaps.
• Update the internal audit procedure first: it is the lowest-effort change and the clearest early signal that the revision has been reviewed.
• Then the auditor competence framework and CPD programme, where the substantive new content sits.
• Brief your audit team on the changes before the next audit cycle, and plan a training intervention where the gap analysis found one.
Common questions
Is ISO 19011:2026 mandatory for certification bodies?
No. ISO 19011 is guidance and nothing is certified or accredited against it. The requirements standard for third-party management system certification remains ISO/IEC 17021-1, which is unchanged. ISO/IEC 17021-1 draws on ISO 19011, which is why ASCB expects accredited bodies to work from the current edition.
Does our accreditation change because of this revision?
No. Your accreditation, its standard and its scope are unchanged. What ASCB expects is that the documents and competence arrangements that reference ISO 19011 are brought to the current edition within the window set out in advisory note ASL(AN)37.
What are the main changes in ISO 19011:2026?
Remote auditing method is now a defined term with developed guidance drawn from ISO/IEC TS 17012; auditor competence now includes understanding when ICT tools and emerging technology, including artificial-intelligence-based evaluation tools, are appropriate for an audit; and the audit programme risk list grows, including the security of ICT methods. The seven principles of auditing are unchanged.
By when do we need to have updated?
There is no transition deadline, because ISO 19011 is a guideline rather than a standard bodies are accredited against: the 2026 edition applies from publication. ASCB expects the updates to be made without delay and to be demonstrable at your next assessment, as set out in advisory note ASL(AN)37.